Protecting passwords remains one of the pillars of security in any organisation. Over the years, various password obfuscation methods have emerged, such as adding random characters, swapping letters for symbols or splitting the password into parts. However, these techniques have significant limits and do not replace current good practice for creating, storing and protecting credentials.
In this article, we explain what password obfuscation methods are, why they are insufficient on their own and what measures companies should adopt to protect access to their systems and document management platforms.
What are password obfuscation methods
Obfuscation consists of making a password less obvious through simple transformations. For example, you can replace “a” with “@” and “o” with “0”, add numbers at the end or insert symbols between letters. The idea is to create a password that looks random but that the user can still remember.
For a long time, many experts recommended these techniques. However, attackers are well aware of these transformations. For this reason, attack tools automatically test variations such as “P@ssw0rd!” based on dictionaries of common words. As a result, an attacker can crack an obfuscated password much faster than it seems.
Why obfuscation is not enough
Today’s attacks rarely try to guess passwords one by one. Instead, they use lists of billions of passwords exposed in data breaches, along with automatic rules that apply substitutions, prefixes and suffixes. Consequently, predictable patterns, such as a word followed by the year, are among the first combinations attackers test.
Furthermore, obfuscation does not solve two frequent problems: reusing the same password across several services and credential theft through phishing. If users hand over their password on a fake site, it hardly matters how well obfuscated it is.
What works: Long and unique passwords
Current cybersecurity recommendations, such as those from NIST and the Portuguese National Cybersecurity Centre, favour length and uniqueness over complex rules. In practice, this means:
- use long passwords, ideally with 15 or more characters;
- prefer passphrases made of several unrelated words;
- use a different password for each service;
- use a password manager to create and store credentials;
- change the password only when there is a suspicion of compromise, not at fixed intervals.
In this way, passwords become hard to guess and, at the same time, easier to manage.
How to store passwords on servers
On the organisation’s side, protecting passwords is not about “obfuscating” them. Organisations should never store passwords in plain text or with reversible encryption. Instead, they should transform them with password-specific hashing functions, such as Argon2id, scrypt or bcrypt, always with a different random value for each user, known as a salt.
| Practice | Assessment |
|---|---|
| Plain text | Unacceptable |
| Reversible encryption | Not advised for passwords |
| Fast hash (MD5, SHA-1) | Insecure |
| Argon2id, scrypt or bcrypt with salt | Recommended |
Thus, even if an attacker obtains the database, they will find it very difficult to recover the original passwords.
Multi-factor authentication: The essential layer
No password is infallible. For this reason, multi-factor authentication should be enabled on all platforms holding sensitive data, including document management platforms. Whenever possible, it is best to prefer phishing-resistant methods, such as FIDO2 security keys or passkeys. That way, even if someone steals the password, they will find it hard to get in.
How to create a strong passphrase
A passphrase is a sequence of words that is easy to remember but hard to guess. For example, four or five unrelated words separated by hyphens form a long and resilient combination. Unlike obfuscated passwords, it does not require memorising symbols in specific positions.
However, some care is needed. The words should not form a well-known phrase, such as a proverb or song lyrics, nor include personal data, such as family members’ names or dates. In addition, each service should have its own passphrase. In this respect, a password manager remains the most practical way to manage multiple credentials.
Checking for compromised passwords
In recent years, data breaches have exposed billions of credentials. Consequently, a password may look strong and yet already appear on the lists used by attackers. For this reason, good practice recommends that systems check new passwords against lists of compromised credentials and reject any that appear there.
Similarly, a company can subscribe to services that send alerts when email addresses from its domain appear in new data breaches. In this way, it can request a change of the affected passwords before attackers use them.
Credentials of external contractors
On document management platforms, many users belong to contractor companies. These users do not always follow the same security practices as the contracting company. It is therefore advisable to require multi-factor authentication for external accounts too, set up individual accounts instead of accounts shared per company and automatically deactivate access when the contract ends. Likewise, access recovery should require proper verification to prevent anyone from impersonating a contractor.
Secure access recovery
Many attacks do not try to guess the password but instead exploit the recovery process. For example, an attacker may call the support desk pretending to be an employee and ask for access to be reset. As such, recovery should require robust identity verification, such as confirmation through a second factor already registered or validation by a manager. Traditional security questions, such as the name of your first pet, should also be avoided, because the answers are often easy to find on social media.
User training
Technology solves much of the problem, but users still play a central role. In this context, training should explain in simple terms why long passwords are more secure, how to use the password manager and how to recognise phishing attempts. Similarly, employees should know who to report to if they suspect a password has been compromised. As a result, the password policy no longer feels like a bureaucratic obligation and instead works as protection for everyone.
Practical example: An updated password policy
Imagine a company whose policy required eight-character passwords with capitals, numbers and symbols, changed every three months. In practice, employees used variations such as “Company@2025”, “Company@2026” and so on.
The company decides to review the policy. First, it requires passphrases of at least 15 characters and stops enforcing periodic changes. Next, it provides a password manager to all employees. Finally, it enables multi-factor authentication on the document management platform and on email. Consequently, passwords become stronger and access recovery requests decrease.
Common mistakes in password management
The most frequent mistake is relying on complexity rules that lead to predictable patterns. Another mistake is sharing accounts between several employees, which makes it impossible to know who performed each action. It is also common to keep passwords in spreadsheets or on paper next to the computer. Finally, many companies do not check whether their users’ passwords appear on lists of credentials exposed in data breaches.
Checklist to protect company credentials
- Do required passwords have an adequate minimum length?
- Do users have an approved password manager?
- Is multi-factor authentication enabled on critical platforms?
- Are passwords stored with Argon2id, scrypt or bcrypt?
- Are new passwords checked against lists of compromised credentials?
- Are there shared accounts that should be removed?
Frequently asked questions
Are password obfuscation methods useless?
They are not useless, but they offer little protection against modern attacks. A long and unique passphrase is much more effective than a common word with symbols.
Should a company force employees to change their password every month?
Current recommendations do not advise mandatory periodic changes, because they lead to weaker passwords. Instead, a change should happen when there is a suspicion of compromise.
Are password managers secure?
Yes, when they come from recognised providers and are protected by a strong passphrase and multi-factor authentication. They also make it effortless to use different passwords for every service.
Will passkeys replace passwords?
On many services, passkeys already allow you to sign in without a password, with greater security and convenience. However, the transition will be gradual, so good password practices will remain necessary for several years.
Conclusion: Beyond password obfuscation methods
Password obfuscation methods had their place, but they are no longer enough against today’s attacks. Today, effective protection relies on long and unique passwords, password managers, storage with suitable hashing functions and multi-factor authentication. In this way, companies better protect their document management platforms and the data that flows through them.
Read also: Access permissions in document management platforms and What IAM is and what it is used for.
For national cybersecurity recommendations in Portugal, see the Portuguese National Cybersecurity Centre (CNCS).